Allow passing of custom headers through settings

[robj]

eg. for token based Authorization

             XHR({
                 url: u.settings.ajax_base + "/signing_key/",
                 extra_params: args,
                 headers: u.settings.headers,
                 ...